The TLS exploit is a neat fusion of two streams in vulnerability research: Cryptanalysis and client-side attacks. In this case, a known client-side problem–namely (that) Web sites are not shielded from one another–is used to break an assumption in cryptography–that a user’s computer will not attack the user.

Users already need to trust all the Web sites they are visiting due to vulnerabilities in their browsers (“drive-by exploits”) and in trusted Web sites (“tab-nabbing”). The new exploit strongly reminds us of this rule.
 

Bản rõ được ký hiệu là M, bản mã là C. Bản rõ được chia ra thành m khối P_1, P_2,...,P_m. Các khối này sẽ được mã hóa thành C_1, C_2,...,C_m.

Hàm mã hóa của mã khối là E_k, trong đó k là khóa. Tương ứng, hàm giải mã là D_k.

Viết X = {X_1}|{X_2}|\cdots|{X_m} nghĩa là kết nối các khối X_i lại với nhau để tạo ra khối X.

Vector khởi tạo (initialization vector) được ký hiệu là IV.

Mã hóa
C_i = E_k(P_i), i=1,..,m
C = C_1|C_2|...|C_m

Giải mã
P_i = D_k(C_i), i=1,..,m
M = P_1|P_2|...|P_m

Mã hóa
C_0 = IV
C_i = E_k(P_i \oplus C_{i-1}), i=1,..,m
C = C_0|C_1|C_2|\cdots|C_m

Giải mã
P_i = D_k(C_i) \oplus C_{i-1}, i=1,..,m
M = P_1|P_2|\cdots|P_m

Phil Rogaway observed that CBC mode is not secure against chosen-plaintext attack if the IV is known or can be predicted by the attacker before he choses his plaintext [1]. Similarly, CBC mode is not secure if the attacker can observe the last ciphertext block before choosing the next block of plaintext, because the last block of ciphertext essentially serves as the IV for the rest of the message.

The attack itself is very simple. Remember that in CBC mode, each plaintext block is XOR'ed with the last ciphertext block and then encrypted to produce the next ciphertext block. Suppose the attacker suspects that plaintext block P_i might be x, and wants to test whether that's the case, he would choose the next plaintext block P_j to be x XOR C_(i-1) XOR C_(j-1). If his guess is correct, then C_j = Encrypt(P_j XOR C_(j-1)) = Encrypt(P_i XOR C_(i-1)) = C_i, and so he can confirm his guess by looking at whether C_j = C_i. [...]

[1] http://www.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipsec-comments-00.txt